b211d44c71712079b26f88d14cd02eb8418a8badb4d39c384c18975f30769887

Sharing

Copy URL Twitter E-mail

General

Target

b211d44c71712079b26f88d14cd02eb8418a8badb4d39c384c18975f30769887
Size

672KB
MD5

18dc28303fdbf7b32fc08c5391e7d910
SHA1

0c6a327af882abcf0c3a70dc7b6e1a30e8728e6a
SHA256

b211d44c71712079b26f88d14cd02eb8418a8badb4d39c384c18975f30769887
SHA512

abb4bad4d20c17d47dac6b8a452555b1f19d25614877d42298ead7e5b870d51b340d6c7a9a377504924832d671c2ecae4a03b80963c279f1392e85de4a9a2282
SSDEEP

12288:1eA7FADu/m9b1+mjBxagGo72sIapdsGx8gmj1yE:1HFMu/m1HBxa/ozICdHqgmX

Score

N/A

Malware Config

Signatures

Files

b211d44c71712079b26f88d14cd02eb8418a8badb4d39c384c18975f30769887
.exe windows x86

9c82236ad14f5d892b7d3eb266c9a2a1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
GetProcAddress
GetModuleHandleA
GetVersionExA
SetLastError
CreateDirectoryA
SetFileAttributesA
GetFileAttributesA
CopyFileA
RemoveDirectoryA
FindNextFileA
GetSystemDirectoryA
GetUserDefaultLangID
WinExec
Sleep
SetCurrentDirectoryA
GetCurrentProcess
GetCurrentThread
FormatMessageA
HeapFree
GetProcessHeap
HeapAlloc
OpenProcess
GetTickCount
CreateProcessA
FlushFileBuffers
HeapSize
SetStdHandle
lstrcmpA
InterlockedExchange
InitializeCriticalSection
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
VirtualAlloc
IsBadCodePtr
IsBadWritePtr
IsBadReadPtr
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FreeLibrary
LoadLibraryA
GetModuleFileNameA
GetPrivateProfileStringA
SetFilePointer
GetLastError
CreateMutexA
WaitForSingleObject
WriteFile
GetTempPathA
GetTempFileNameA
CreateFileA
GetFileSize
ReadFile
FindFirstFileA
FindClose
DeleteFileA
CloseHandle
LocalFree
lstrlenW
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
TlsAlloc
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter

user32

LoadStringA
DefWindowProcA
PostQuitMessage
UpdateWindow
ShowWindow
FindWindowA
KillTimer
PostMessageA
CreateWindowExA
SetTimer
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
RegisterClassA

winspool.drv

EnumPrintersA
ClosePrinter
GetPrinterDriverA
OpenPrinterA
EnumPrinterDriversA
GetPrinterDriverDirectoryA
GetPrinterA
SetPrinterA
AddMonitorA
DeleteMonitorA
AddPrinterDriverA

advapi32

EqualSid
LookupAccountSidA
CreateProcessAsUserA
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetLengthSid
CopySid
RegGetKeySecurity
GetSecurityDescriptorDacl
GetAclInformation
GetSidSubAuthorityCount
GetAce
GetSidSubAuthority
RegSetKeySecurity
RegDeleteKeyA
RegSetValueExA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
RegOpenKeyA
RegQueryValueExA
RegCloseKey

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 508KB - Virtual size: 1.6MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9c82236ad14f5d892b7d3eb266c9a2a1

Headers

File Characteristics

Imports

kernel32

user32

winspool.drv

advapi32

shell32

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

.vmp0 Size: 508KB - Virtual size: 1.6MB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.vmp0
Size: 508KB - Virtual size: 1.6MB